The role of a security module is to control the access to a stream transporting encrypted digital data made available to users by a broadcasting server. In the particular case of the Pay-TV field, a user unit or decoder allows the access and decryption of the encrypted audio/video data stream broadcasted according to the rights registered in the security module associated to said decoder.
The security module may mainly be provided according to three different forms. One of these is a microprocessor card, a smart card or more generally a protected electronic module that is reputedly tamper-proof. This type of generally removable module is inserted into a suitable reader that connects it to the decoder.
A second known form is that of an integrated circuit case placed, generally irremovably and definitively, inside the box of the decoder. An embodiment is made up of a circuit mounted on a socket or connector as a SIM card (Subscriber Identity Module) in a mobile telephone for example.
In a third form, the security module is arranged inside the case of an integrated circuit having also another function, for example in a decryption module or in the central microprocessor of the decoder.
These security modules provided with communication interfaces receive messages intended on one hand to manage the access rights to the broadcasted stream and on the other hand to update or modify the software or firmware assuring the functioning of the module itself.
These messages are called administration or management messages EMM (Entitlement Management Message).
The updates of the rights in the security modules of the user units are carried out by sending of management messages EMM addressed to the concerned units. According to an example of configuration, the management center receives a request transmitted by the security module and transmits in response an EMM message containing, for example, a key allowing the updating of access rights. The security module transmits a reception confirmation message to the management center.
Concerning the firmware stored in the security module, the modifications, in general in the form of pieces of code (patches), constitute a set of EMM messages transmitted to the module in the transport stream of the digital data or in the stream of the control messages ECM or also in a separate stream.
At present, these patches are limited in size and certain cards (or security modules) that cannot be updated to the most recent version are able to decrypt the stream or access to it. Therefore, a new card or a recycled card accessing the stream for first time is immediately functional even without the updating of its firmware. A possible modification of the latter is carried out progressively with EMM messages broadcasted in the stream during periods of reduced data throughput.
The document US2005/0091699 describes a method and a system of redirection of software downloading in a cable television network. A downloading control message transmitted from a management center to reception terminals (set top boxes) controls the loading and installation of programs by these terminals. The message provides to the terminal all the necessary information for instantaneous acquisition of data such as a program identifier, a transmission channel identifier, a packet identifier PID or an URL address allowing the location of the data to be downloaded. The message also contains the information allowing the terminal to authenticate and install the new data. The latter compose programs intended to control the terminal or to add supplementary functionalities such as a messaging service or a television program guide. The operating system of the terminal as well as the applications using this system can also be updated by this method.
The document EP1607821 describes a secure updating method of software in a security module. When a program block is ready to be broadcasted, the method consists of determining a target area in the memory of the security module. Once the location of this area is known, the content that had been programmed during the personalization of the module can be retrieved thanks to the data stored by the management center. A second block obtained by a reversible mixing operation of this data with the block to be broadcasted is transmitted to the concerned security module. On reception, the content of the target memory is read in order to obtain, by a reverse mixing operation, the initial program block that will be stored in the memory of the security module.
The method and the system of the document US2005/0091699 do not allow the loading or updating of the firmware of the security module but only of the software or applications of the reception terminal. A new version of the software of the terminal can certainly ensure the improved working of a security module but in certain cases, however it becomes necessary to update the firmware of the security module itself.
The drawback of the method of the document EP1607821 resides in the fact that it only allows the loading or updating of security module firmware with successive blocks, which can be tedious when the program and/or the frequency of the updates are large. Certain types of security modules or chip cards require patches having a relatively large size and a large number of EMM messages to transmit them entirely. When these messages are transmitted in the digital data stream also comprising the encrypted audio/video data of content and the control messages, the update can take several hours until the reception of the complete patch.
In case the patch should be essential for decrypting the data of the stream, a new card inserted into the decoder leads, for example, to a prolonged absence of the image on the television screen; such an interruption being unacceptable.